gate2: fix migration 0019 duplicate deleted_at on roles (IF NOT EXISTS)

alembic/versions/0019_rbac_groups.py

@@ -65,14 +65,12 @@ def upgrade() -> None:
         sa.Column("permission_version", sa.Integer, nullable=False, server_default="1"),
     )
     # Add missing TimestampMixin + SoftDeleteMixin columns
+    # Note: deleted_at may already exist if 0012_soft_delete ran first
     op.add_column(
         "roles",
         sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
     )
-    op.add_column(
-        "roles",
-        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
-    )
+    op.execute("ALTER TABLE roles ADD COLUMN IF NOT EXISTS deleted_at TIMESTAMP WITH TIME ZONE")
 
     # ── Seed default roles per tenant ──
     # For each tenant, create admin/editor/viewer role records if they don't exist